Method to calculate a risk score of a folder that has been scanned for confidential information

ABSTRACT

A method for calculating a risk score of a data object may include obtaining a severity level associated with a data object. The severity level may be calculated based on presence of confidential information in the data object. The data object may be a file or a folder. The severity level may be calculated using a data loss prevention policy. The method may further include obtaining metadata associated with the data object. The metadata may comprise at least one of access permission data for the data object and access usage data for the data object. The method may further include calculating a risk score for the data object based on the severity level and the metadata associated with the data object.

RELATED APPLICATIONS

This application is related to and claims the benefit of U.S.Provisional Patent application Ser. No. 61/423,053, filed Dec. 14, 2010,which is hereby incorporated by reference. This application is furtherrelated to and claims the benefit of U.S. Provisional Patent applicationSer. No. 61/419,040, filed Dec. 2, 2010, which is hereby incorporated byreference.

FIELD

Embodiments of the invention relate to data loss protection, and moreparticularly to calculating a risk score of a folder that has beenscanned.

BACKGROUND

Data Loss Prevention (DLP) involves computer and information security,where DLP systems identify, monitor, and protect data in use (e.g.,endpoint actions), data in motion (e.g., network actions), and data atrest (e.g., data storage). Typically, a DLP system creates fingerprintsof confidential information that requires protection, and then uses thefingerprints to detect the presence of confidential information invarious files, messages and the like. Confidential information may bestored in a structured form such as a database, a spreadsheet, etc., andmay include, for example, customer, employee, patient or pricing data.In addition, confidential information may include unstructured data suchas design plans, source code, CAD drawings, financial reports, etc.

Many organizations store large amounts of confidential information infiles that are accessible to users within the organization. Since accessto this data is essential to the job function of many users within theorganization, there are many possibilities for theft or accidentaldistribution of this confidential information. Theft or benigninadvertent disclosure of confidential information represents asignificant business risk in terms of the value of the intellectualproperty and compliance with corporate policies, as well as the legalliabilities related to government regulatory compliance. However, with alarge number of files and users, it is difficult to assess whichconfidential files have a high risk of distribution and need to beremediated quickly.

SUMMARY

A method and apparatus for calculating a risk score of a data object isdescribed. In an exemplary method of one embodiment, a severity levelassociated with a data object is obtained. In one embodiment, theseverity level is calculated based on presence of confidentialinformation in the data object. The data object may be a file or afolder. The severity level may be calculated using a data lossprevention policy. Metadata associated with the data object is obtained.The metadata may comprise at least one of access permission data for thedata object and access usage data for the data object. A risk score iscalculated for the data object based on the severity level and themetadata associated with the data object.

In some embodiments, the calculation of the risk score can be adjustedbased on one or more configuration parameters. In some embodiments, theconfiguration parameters can be set by a user.

In some embodiments, the data object is a folder comprising one or morefiles, and the risk score for the folder comprises a risk score for eachof the one or more files. In some embodiments, the access permissiondata is a permission access control list is associated with a number ofusers permitted to access the data object. In some embodiments, theaccess usage data for the data object defines historical data for thedata object, the historical data comprising a number of users that haveaccessed the data object during a predetermined amount of time.

In some embodiments, prior to calculating the risk score for the dataobject, a configuration parameter, a configuration parameter is obtaineddefining the metadata used to calculate the risk score. In someembodiments, the risk score is calculated for the data object based onthe severity level and the metadata defined by the configurationparameter.

In some embodiments, a weight is assigned to the risk score for the dataobject, the weight being assigned based on a risk score of one or moreother data objects to be included in a risk report. In some embodiments,the risk report is created including the weighted risk score for thedata object. In some embodiments, the risk report is displayed in a userinterface.

In addition, a computer readable storage medium for calculating a riskscore of a data object is described. An exemplary computer readablestorage medium provides instructions, which when executed on aprocessing system causes the processing system to perform a method suchas the exemplary methods discussed above.

Further, a system for calculating a risk score of a data object isdescribed. An exemplary system may include a memory and a processorcoupled with the memory. In some embodiments of the exemplary system,the processor is to obtain a severity level associated with a dataobject. The severity level may be calculated based on presence ofconfidential information in the data object. The data object may be afile or a folder. In one embodiment, the processor is to calculate theseverity level based on the content of the data object and a data lossprevention policy. The processor is to obtain metadata associated withthe data object. The metadata may comprise at least one of accesspermission data for the data object and access usage data for the dataobject. The processor is to calculate a risk score for the data objectbased on the severity level and the metadata associated with the dataobject.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood more fully from the detaileddescription given below and from the accompanying drawings of variousembodiments of the invention, which, however, should not be taken tolimit the invention to the specific embodiments, but are for explanationand understanding only.

FIG. 1 illustrates an exemplary network architecture in whichembodiments of the invention may operate.

FIG. 2A is a block diagram of one embodiment of data loss preventionsystem;

FIG. 2B is a block diagram of one embodiment of a risk calculationsystem;

FIG. 3 is a flow diagram of one embodiment of a method for calculating arisk score for a data object;

FIG. 4 is a flow diagram of one embodiment of a method for adjusting thecalculation of a risk score for a data object based on configurationparameters;

FIG. 5 illustrates an exemplary GUI for presenting a risk report inaccordance in accordance with one embodiment of the invention; and

FIG. 6 is a block diagram of an exemplary computer system that mayperform one or more of the operations described herein.

DETAILED DESCRIPTION

A method and apparatus for calculating a risk score of a data object aredescribed. In one embodiment, the data object is a folder containing oneor more files. In one embodiment, a severity level associated with adata object is obtained. In one embodiment, the severity level iscalculated based on presence of confidential information in the dataobject. Metadata associated with the data object is obtained. Themetadata may include a permission access control list and/or accessinformation for the data object. A risk score is calculated for the dataobject based on the severity level and the metadata associated with thedata object.

Embodiments of the present invention provide a risk calculation systemthat adjusts the calculation of the risk score based on one or moreconfiguration parameters. In some embodiments, the configurationparameters can be set by a user. The configuration parameters can adjustthe metadata that is used to calculate the risk score. As a result, theuser can customize the risk score to reflect the importance of themetadata used to calculate the risk score.

In the following description, numerous details are set forth. It will beapparent, however, to one of ordinary skill in the art having thebenefit of this disclosure, that embodiments of the present inventionmay be practiced without these specific details.

FIG. 1 is a block diagram of an exemplary network architecture 100, inwhich embodiments of the present invention may operate. The networkarchitecture 100 may include a data permission and access system 104, adata loss prevention system 112, a risk calculation system 120, and oneor more user devices 128 coupled via a network 102 (e.g., public networksuch as the Internet or private network such as a local area network(LAN)). The user devices 128 may include personal computers, laptops,PDAs, mobile phones, network appliances, etc.

The data permission and access system 104, the data loss preventionsystem 112, and the risk calculation system 120 may reside on the sameor different machines (e.g., a server computer system, a gateway, apersonal computer, etc.). They may run on one Local Area Network (LAN)and may be incorporated into the same physical or logical system, ordifferent physical or logical systems.

Alternatively, data permission and access system 104, the data lossprevention system 112, and the risk calculation system 120, and userdevices 128 may reside on different LANs that may be coupled togethervia the Internet but separated by firewalls, routers, and/or othernetwork devices. In yet another configuration, the data loss preventionsystem 112 may reside on a server, or different servers, coupled toother devices via a public network (e.g., the Internet) or a privatenetwork (e.g., LAN). It should be noted that various other networkconfigurations can be used including, for example, hostedconfigurations, distributed configurations, centralized configurations,etc.

The network architecture 100 further includes data stores 126 coupled tothe network 102. The data stores 126 may represent a single or multipledata structures (databases, repositories, files, etc.) residing on oneor more mass storage devices, such as magnetic or optical storage baseddisks, tapes, or hard drives. The data stores 126 may store any kind ofdata pertaining to the operation of an organization including emails,shared workspaces, etc. The data stores 126 can be centralized datarepositories that may contain confidential documents and therefore needto be protected by data loss prevention system 112. The data stores 126may be, for example, part of a network-attached storage (NAS) system ora storage area network (SAN) system.

The data loss prevention system 112 protects confidential informationmaintained by an organization. Confidential information may be stored ina structured form such as a database, a spreadsheet, etc., and mayinclude, for example, customer, employee, patient or pricing data. Inaddition, confidential information may include unstructured data such asdesign plans, source code, CAD drawings, financial reports, humanresources reports, customer or patient reports, pricing documentation,corporate mergers and acquisitions documentation, government (e.g.Securities and Exchange Commission) filings, and any other confidentialinformation that requires restricted user access. The data lossprevention system 112 protects confidential information using DLPpolicies 116. A DLP policy includes rules for scanning content to detectthe presence of confidential information. The content to be scanned maybe stored in centralized data repositories such as data stores 126 thatmay potentially contain documents with confidential information. Inaddition, the content to be scanned may include documents associatedwith a client device such as user devices 128. Documents associated witha user device 128 may include documents stored locally on user device128 and network-based documents stored for user device 128 (e.g., aspart of NAS or SAN system). A document can be a file, a message, a webrequest or any other data item that is stored on a storage medium and isaccessible using a name or any other identifier.

Data loss prevention system 112 may also instruct scan agents 132located on one or more of the user devices 128 to scan documents storedlocally for confidential information. Data loss prevention system 112may do this according to one or more of the DLP policies 130.

When monitoring content for the presence of confidential information,the data loss prevention system 112 may use fingerprints of the sourcedata to facilitate more efficient searching of the content. Fingerprintsmay include hashes of source data, encrypted source data, or any othersignatures uniquely identifying the source data. The data lossprevention system 112 may distribute fingerprints to scan agents 132,and scan agents 132 may use fingerprints when scanning documents forconfidential information in accordance with one or more DLP policies130. Data object scanner 114 in the data loss prevention system 112 mayuse fingerprints when scanning documents for confidential information inaccordance with one or more DLP policies 116.

A policy may include a set of rules that specify what confidentialinformation (e.g., confidential data stored in a secure repository or asecure database) needs to be present in the content being scanned inorder to trigger a policy violation. In addition, policies may specifywhen particular content should be scanned, which content (e.g., filesaccessible to employees of an organization or email messages stored on amail server of the organization) should be scanned, etc. Further,policies may specify which actions should be taken when the documentsbeing scanned contain confidential information. For example, the policymay require that access to the content be blocked, reported, etc. Dataloss prevention system 112 creates DLP policies 116 (e.g., based on userinput or based on relevant regulations) and distributes relevant DLPpolicies to various entities. For example, DLP policies 130 pertainingto scanning content stored on user devices 128 are distributed to userdevices 128. DLP policies 116 pertain to scanning content stored incentralized data stores 126.

An organization may maintain multiple data stores 126 and may store alarge number of documents in each data store 126. The stored documentsmay be frequently modified by different employees of the organizationand new documents may be often added to the data stores 126. Hence, DLPpolicies 116 may request that data stores 126 be scanned frequently toprevent loss of confidential information.

In one embodiment, a DLP policy violation in a scanned document triggersan incident. Once an incident is triggered, the document is assigned aseverity level by data object scanner 114 of the DLP system 112. In someembodiments, the higher the severity level, the greater the businessrisk of losing the document or having the contents of the document beexposed to unauthorized users. In one embodiment, the severity level canbe assigned by determining the importance of the rule in the DLP policy116 violated by the document. The importance of the rule may bespecified by a user. In an alternate embodiment, the severity level canbe determined based on the number of DLP policies violated by thedocument. In some embodiments, each incident triggered by a DLPviolation can be assigned a severity level. In some embodiments, theseverity level for a document can be an aggregation of the severitylevels for each incident related to the document (e.g., sum of allseverity levels, product of all severity levels, etc.). In someembodiments, the severity level can be determined by the sensitivity orconfidentiality of the content in the document. In some embodiments, theseverity level for an incident can be determined by the context in whichthe incident happened (e.g., specific protocols, users, groups ofpeople, devices involved, etc.). The severity level for the document canbe stored in severity levels store 118. In one embodiment, the severitylevel is a numerical value with a predetermined range (e.g., 1 through4). In one embodiment, the predetermined range for the severity levelcan be configured by a user of the data loss prevention system 112. Insome embodiments, when an incident is triggered, a number of incidentsassociated with the document can be incremented and stored with theseverity level. In some embodiments, when an incident is triggered, adetermination can be made of whether a hazard is associated with theincident. A hazard refers to combination of a document and a policyviolated by the document. If a hazard is not associated with theincident, a new hazard can be created for the combination of thedocument and the policy violated by the document. In some embodiments,there may be only one hazard for a document and policy violationcombination.

Data permission and access system 104 contains data monitor 106. Datamonitor 106 can monitor documents stored in centralized datarepositories such as data stores 126 or documents associated with aclient device such as user devices 128. In one embodiment, data monitor106 can monitor the documents for accesses of the documents. In oneembodiment, if a document is accessed, e.g., by a user or by anapplication, data monitor 106 can store information associated with theaccess in storage, such as number of accesses store 108. In oneembodiment, the information associated with the access in storage caninclude the number of users who have accessed the document or itscontent over a predetermined amount of time (e.g., 7 days). In analternate embodiment, the information associated with the access instorage can include the number of accesses for the document or itscontent over a predetermined amount of time (e.g., 7 days). In oneembodiment, the predetermined amount of time can be configurable by auser. In one embodiment, when a document is accessed, data monitor 106can cause a number of accesses to be incremented for the document.

In one embodiment, data monitor 106 can monitor changes in a permissionaccess control list (ACL) associated with each of the documents. Apermission ACL can define the permissions for the document. For example,the permission ACL for a document can define the number of users who arepermitted to access the document or its contents. In one embodiment,data monitor 106 can store the permission ACL in permission ACLs store110.

Risk calculation system 120 can calculate a risk score for a folder thathas been scanned by data loss prevention system 112. The folder cancontain one or more files. The terms documents and files are usedinterchangeably herein, and can include any stored data items, includingmessages, message attachments, requests, and files. In one embodiment,the risk score can be calculated for each of the files in the folder,and then aggregated together to calculate a risk score for the folder.In an alternate embodiment, the risk score can be calculated for eachhazard in the folder, and then aggregated together to calculate a riskscore for the folder. For each file or hazard in the folder, riskcalculation system 120 can obtain the severity level associated with thefile or hazard. If the risk calculation system 120 obtains the severitylevel associated with the hazard, risk calculation system 120 may firstdetermine a file associated with the hazard. In one embodiment, riskcalculation system 120 may obtain the severity level for a file fromseverity levels store 118 maintained by data loss prevention system 112.Data loss prevention system can access severity levels store 118 toobtain the severity level for the file, and can provide the obtainedseverity level to risk calculation system 120. In certain embodiments,additional data (metadata) can be obtained for each file by riskcalculation system 120. In one such embodiment, the additional data maybe the permission ACL for each file. In this embodiment, riskcalculation system 120 may obtain the permission ACL from datapermission and access system 104. Data permission and access system 104can access permission ACLs store 110 to obtain the permission ACL forthe file, and can provide the obtained permission ACL to riskcalculation system 120, which then determines how many users are allowedaccess to the file. In another such embodiment, the additional data maybe the number of accesses for each file. In this embodiment, riskcalculation system 120 may obtain the number of accesses from datapermission and access system 104. Data permission and access system 104can access number of accesses store 108 to obtain the number of accessesfor the file, and can provide the obtained number of accesses to riskcalculation system 120. In yet another such embodiment, the additionaldata may be both the number of users in the access control list andnumber of accesses for each file. Using the severity levels and theadditional data, a risk score can be calculated for each file. The riskscore for the folder is calculated by aggregating the risk scores forthe files. In one embodiment, the risk score for each file and the riskscore for the folder is stored in risk scores store 122.

In one embodiment, a risk report is created using the risk score for afolder. In one embodiment, the risk report can be displayed in agraphical user interface (GUI) viewable by a user. The risk report maybe stored in risk reports store 124.

FIG. 2A is a block diagram of one embodiment of a data loss preventionsystem 200. The data loss prevention system 200 may include data objectidentifier 202, data object scanner 204, severity level calculator 206,policies store 208, and severity levels store 210. The components of thedata loss prevention system may represent modules that can be combinedtogether or separated into further modules, according to someembodiments.

The data object identifier 202 may identify data objects, or documents,that are to be scanned for confidential information. In someembodiments, the data objects to be scanned may be part of a centralizeddata repository and are to be scanned over a network. In someembodiments, data object identifier 202 may receive a request to scanthe data objects from a risk calculation system in accordance with oneor more DLP policies. In other embodiments, data object identifier 202may receive a request to scan the data objects from a controller inaccordance with one or more DLP policies. The data objects to be scannedmay be one or more directories of documents, part of a directory ofdocuments, etc.

Data object scanner 204 may scan data objects that data objectidentifier 202 has identified to be scanned. In some embodiments, dataobject identifier 202 can scan the data objects for confidentialinformation using fingerprints of data objects that have been classifiedas containing confidential information. In one embodiment, data objectscanner 204 may scan the data objects in accordance with at least oneDLP policy. Data object scanner 204 may retrieve the DLP policy frompolicies store 208.

Severity level calculator 206 calculates the severity level of a dataobject on which an incident is trigged. An incident may be triggered fora data object when a scan of the data object determines that the dataobject violates a DLP policy. In some embodiments, the severity levelassigned to the data object may be based on the sensitivity orconfidentiality of the content in the data object. In some embodiments,the higher the severity, the greater the business risk of losing thedata object or having the contents of the data object be exposed tounauthorized users. In one embodiment, the severity level can beassigned by determining the importance of the rule in the DLP policyviolated by the data object. In an alternate embodiment, the severitylevel can be determined based on the number of DLP policies violated bythe data object. In another alternate embodiment, the severity level canbe assigned by determining a number of incidents (policy violations) forthe data object and normalizing the value to a predetermined range(e.g., 1-4). For example, if a data object has a high number ofincidents associated with it (e.g., 20), a higher severity level (e.g.,4) may be assigned to a data object. In another example, if a dataobject has a low number of incidents associated with it (e.g., 2), alower severity level (e.g., 1) may be assigned to the data object. Theseverity level of a data object can be stored in severity levels store210.

FIG. 2B is a block diagram of one embodiment of a risk calculationsystem 250. The risk calculation system 250 may include data objectidentifier 252, parameter identifier 254, severity level obtainer 256,access information obtainer 258, permission ACL obtainer 260, risk scorecalculator 262, risk report creator 264, risk scores store 266, and riskreports store 268. The components of the risk calculation system mayrepresent modules that can be combined together or separated intofurther modules, according to some embodiments.

The data object identifier 252 may identify data objects that requirecalculation of a risk score. In some embodiments, a calculation of therisk score is performed at predefined times for a folder. In someembodiments, a calculation of the risk score is performed when a file ina folder is modified. In some embodiments, a calculation of the riskscore is performed when a file in a folder triggers an incident. In someembodiments, a user requests a risk score for a data object that is afolder. The data object identifier 252 may identify one or more files orhazards in the folder. If data object identifier 252 identifies hazardsin the folder, data object identifier 252 may identify a file associatedwith each hazard. In some embodiments, the data object may be part of acentralized data repository and the risk score is to be calculated overa network.

Parameter identifier 254 may identify one or more configurationparameters to use in the calculation of the risk score for the dataobject. In some embodiments, a user can set the values of theconfiguration parameters. In some embodiments, the configurationparameters can include coefficients for the calculation of the riskscore. In some embodiments, the configuration parameters can determinewhich data values may be used in the calculation of the risk score. Insome embodiments, the configuration parameters can determine theoperation used to calculate the risk score. In some embodiments, none orsome of the configuration parameters may be set by a user. In theseembodiments, a default set of configuration parameters can be used whencalculating the risk score.

Severity level obtainer 256 obtains the severity level associated with adata object on which the risk score calculation is to be performed. Insome embodiments, the severity level can be obtained from a data lossprevention system. In some embodiments, the number of incidents for adata object can be obtained along with the severity level for the dataobject. An incident may be triggered for a data object because a scan ofthe data object determines that the data object violates a DLP policy.In some embodiments, the severity level assigned to the data object maybe based on the sensitivity or confidentiality of the content in thedata object. In some embodiments, the higher the severity, the greaterthe business risk of losing the data object or having the contents ofthe data object be exposed to unauthorized users. In one embodiment, theseverity level can be assigned by determining the importance of the rulein the DLP policy violated by the data object. In an alternateembodiment, the severity level can be determined based on the number ofDLP policies violated by the data object. In another alternateembodiment, the severity level can be assigned by determining a numberof incidents for the data object and normalizing the value to apredetermined range (e.g., 1-4).

Access information obtainer 258 obtains the access informationassociated with a data object on which a risk score is to be calculated.In some embodiments, the access information can be obtained from a datapermission and access system. In some embodiments, the accessinformation for a data object can represent a number of times that thedata object or its content has been accessed by one or more users duringa predetermined period of time. In one embodiment, the predeterminedperiod of time can be configurable by a user.

Permission ACL obtainer 260 can obtain the permission ACL associatedwith a data object on which a risk score is to be calculated. In someembodiments, the permission ACL information can be obtained from a datapermission and access system. In some embodiments, the permission ACLfor a data object specifies a number of users who are permitted toaccess the document or its contents.

Risk score calculator 262 can calculate a risk score for a data objectidentified by data object identifier 252. In one embodiment, if the dataobject is a folder, risk score calculator 262 can calculate a risk scorefor each file in the folder, and may aggregate the risk scores of thefiles to calculate a risk score for the folder. In an alternateembodiment, risk score calculator 262 can calculate a risk score foreach hazard in the folder, and then aggregated together to calculate arisk score for the folder. In some embodiments, risk score calculator262 can calculate the risk score based only on the severity levelassociated with the data object obtained from severity level obtainer256. In some embodiments, risk score calculator 262 can calculate therisk score based on the severity level associated with the data objectand additional data. In one such embodiment, the additional data may bethe permission ACL for the data object obtained from permission ACLobtainer 260. In another such embodiment, the additional data may be thenumber of accesses for the data object obtained from access informationobtainer 258. In yet another such embodiment, the additional data may beboth the permission ACL for the data object and number of accesses forthe data object. Using the severity level for the data object and theadditional data for the data object, a risk score can be calculated forthe data object. In some embodiments, the calculation of the risk scorecan be adjusted by risk score calculator 262 based on the configurationparameters identified by parameter identifier 254. In some embodiments,the risk score may be calculated by summing the severity level and theadditional data. In other embodiments, the risk score may be calculatedby multiplying the severity level and the additional data. In someembodiments, coefficients are used for the components (e.g., severitylevel, ACL, number of accesses) involved in the risk score calculation.The risk score of a data object can be stored in risk scores store 266.If the data object is a folder, the risk score of each file in thefolder can be stored in risk scores store 266, in addition to the riskscore for the folder being stored in risk scores store 266.

Risk report creator 264 can create a risk report using the risk scorefor a data object. In some embodiments, the risk report can include therisk score for folders selected by a user without including the riskscore for files within the folder. In some embodiments, the risk reportcan include the risk score for a folder and additional data, such as thenumber of incidents associated with files in the folder or the DLPpolicies which have the highest number of incidents or violations in thefolder. In some embodiments, the risk report can include the owners ofthe files in the folder which caused violations. In some embodiments,the risk report is displayed in a graphical user interface (GUI)viewable by a user. The risk report may be stored in risk reports store268.

FIG. 3 is a flow diagram of one embodiment of a method 300 forcalculating a risk score for a data object. The method 300 is performedby processing logic that may comprise hardware (circuitry, dedicatedlogic, etc.), software (such as is run on a general purpose computersystem or a dedicated machine), or a combination of both. In oneembodiment, the method 300 is performed by risk calculation system 120of FIG. 1 or risk calculation system 250 of FIG. 2B.

Referring to FIG. 3, processing logic begins by identifying a dataobject on which to perform the risk score calculation at step 310. Insome embodiments, the data object can be identified in a requestreceived from a user. In some embodiments, the data object can beidentified in a request received at predefined times for the dataobject. In some embodiments, the data object can be identified in arequest received when the data object is created or modified. In someembodiments, the data object can be identified in a request receivedwhen the data object triggers an incident. In some embodiments, the dataobject can be a folder. If the data object is a folder, the files orhazards in the folder can be identified, and a risk score can becalculated for each of the files or hazards in the folder. If hazardsare identified in the folder, a file associated with each hazard may beidentified. The data object on which to perform the risk calculation maybe associated with a user device or reside in a centralized datarepository.

At step 320, processing logic obtains configuration parameters. In someembodiments, a user can configure the configuration parameters. In someembodiments, the configuration parameters can include coefficients forthe risk score calculation. For example, if a risk score calculationuses a severity level and access information to calculate the riskscore, a user may set a coefficient for the severity level value to 1,and the coefficient for the access information to 0.5. In this example,the risk score calculation would be adjusted such that the full value ofthe severity level and only half of the value of the access informationwas used to calculate the risk score.

In some embodiments, the configuration parameters can determine whichdata is used in the calculation of the risk score. For example, theconfiguration parameters may be set such that only a severity level anda permission ACL of a data object are used to calculate the risk score.In another example, the configuration parameters may be set such that aseverity level, an access information, and a permission ACL are used tocalculate the risk score for a data object.

In some embodiments, the configuration parameters can determine theoperation used to calculate the risk score. For example, theconfiguration parameters may be set such that the risk score iscalculated using a summation of values. In another example, theconfiguration parameters maybe set such that the risk score iscalculated using a multiplication of values.

In some embodiments, none or some of the configuration parameters areset. In these embodiments, default configuration parameters are used.For example, the default set of configuration parameters can be that therisk score is calculated using a coefficient of 1.0 for all data values,using the data values for the severity level, the access information,and the permission ACL, and summing the data values. In certainembodiments, step 320 is optional and is not performed. In certainembodiments, if step 320 is omitted, method 300 proceeds to step 330after step 310 is performed.

At step 330, a severity level is obtained for a data object. In someembodiments, the severity level can be obtained from a data lossprevention system. In some embodiments, the number of incidents for adata object is obtained along with the severity level for the dataobject. In certain embodiments, step 330 is optional and is notperformed. In certain embodiments, if step 330 is omitted, method 300proceeds to step 340 after step 320 is performed.

At step 340, access information is obtained for a data object. In someembodiments, the access information can be obtained from a datapermission and access system. In some embodiments, the accessinformation for a data object can represent a number of times that thedata object or its content has been accessed by one or more users duringa predetermined amount of time. In some embodiments, the accessinformation for a data object can represent a number of users who haveaccessed the document or its content over a predetermined amount oftime. In one embodiment, the predetermined amount of time isconfigurable by a user. In certain embodiments, step 340 is optional andis not performed. In certain embodiments, if step 340 is omitted, method300 proceeds to step 350 after step 330 is performed.

At step 350, a permission ACL associated with a data object is obtained.In some embodiments, the permission ACL information can be obtained froma data permission and access system. In some embodiments, the permissionACL for a data object can specify a number of users who are permitted toaccess the document or its contents. In certain embodiments, step 350 isoptional and is not performed. In certain embodiments, if step 350 isomitted, method 300 proceeds to step 360 after step 340 is performed.

At step 360, a risk score is calculated for the data object. In someembodiments, the calculation of the risk score for the data object maybe adjusted based on the configuration parameters obtained at step 320.The adjustment of calculating a risk score based on configurationparameters is described below in conjunction with FIG. 4. In someembodiments, using the severity level for the data object and theadditional data for the data object, a risk score can be calculated forthe data object. In some embodiments, the risk score may be calculatedby performing a calculation on the severity level and the additionaldata. In other embodiments, the risk score may be calculated byperforming a calculation on a component of risk due to the severitylevel and a component of risk due to the additional data. In theseembodiments, the component of risk due to the severity level may beassigned based on the number of incidents associated with the dataobject and the severity level of each of the incidents. In theseembodiments, the component of risk due to the number of accesses may beassigned based on the number of users accessing the data object over apredetermined time period (e.g., past 7 days, past 10 days, etc.). Inthese embodiments, the component of risk due to the permission ACL maybe the number of unique users allowed access in the permission ACL. Insome embodiments, the risk score may be calculated by summing theseverity level and the additional data. For example, the risk score maybe calculated as:risk score=severity level+number of accesses+permission ACL.In some embodiments, the risk score may be calculated by summing thecomponent of risk due to the severity level and the component of riskdue to the additional data. For example, the risk score may becalculated as:risk score=R(S)+R(H)+R(P),where R(S) is the component of risk due to the number and severity ofincidents, R(H) is the component of risk due to the number of accesses,and R(P) is the component of risk due to the permission ACL.In other embodiments, the risk score may be calculated by multiplyingthe severity level and the additional data. For example, the risk scoremay be calculated as:risk score=severity level*(number of accesses+permission ACL).In some embodiments, the risk score may be calculated by multiplying thecomponent of risk due to the severity level with the component of riskdue to the additional data. For example, the risk score may becalculated as:risk score=R(S)*(R(H)+R(P)).

At step 370, a determination is made of whether there are additionaldata objects that require a calculation of a risk score. Thedetermination can be positive if the risk score is to be calculated fora folder, and there are additional files in the folder that require acalculation of a risk score. The determination can be negative if therisk score has been calculated for a single data object. If the dataobject is a folder, the determination can be negative if each file inthe folder has a calculated risk score. If there are additional dataobjects that require a calculation of a risk score, the method 300proceeds to step 320 to identify the next data object on which toperform the calculation. If there are no additional data objects, themethod 300 proceeds to step 380.

At step 380, a risk report is created using the risk score for a dataobject. In some embodiments, the risk report can include the risk scorefor the data object(s) obtained at step 310. In some embodiments, therisk report can normalize the risk scores for the data objects includedin the risk report. For example, the highest risk score included in therisk report can be set to a value of 100, and the other risk scores arenormalized to a scale of 1-100 based on a comparison with the highestrisk score. In some embodiments, if the data object is a folder, therisk report can include the risk score for the folder without includingthe risk score for files within the folder. In some embodiments, if thedata object is a folder, the risk report can include the risk score forthe folder and additional data, such as the number of incidentsassociated with files in the folder or the DLP policies which have thehighest number of incidents or violations in the folder. In someembodiments, the risk report can include the owner of the data objectwhich caused an incident. In some embodiments, the risk report isdisplayed in a GUI viewable by a user.

FIG. 4 is a flow diagram of one embodiment of a method 400 for adjustingthe calculation of a risk score for a data object based on configurationparameters. The method 400 is performed by processing logic that maycomprise hardware (circuitry, dedicated logic, etc.), software (such asis run on a general purpose computer system or a dedicated machine), ora combination of both. In one embodiment, the method 400 is performed byrisk calculation system 120 of FIG. 1 or risk score calculator 262 ofFIG. 2.

Referring to FIG. 4, processing logic begins at step 410 to determine ifa permission ACL parameter is on (e.g., value of 1) in configurationparameters for the risk score calculation. If the permission ACLparameter is on, processing logic proceeds to step 420. If thepermission ACL parameter is off (e.g., value of 0), processing logicproceeds to step 430.

At step 420, the permission ACL for the data object is included in therisk score calculation because the permission ACL parameter was on. Forexample, the risk score calculation may be:risk score=severity level+permission ACL; or risk score=severitylevel*permission ACL.

At step 430, a determination is made of whether the access parameter ison (e.g., value of 1) in configuration parameters for the risk scorecalculation. If the access parameter is on, processing logic proceeds tostep 440. If the access parameter is off (.e.g., value of 0), processinglogic proceeds to step 450.

At step 440, the access for the data object is included in the riskscore calculation because the access parameter was on. For example, therisk score calculation may be:risk score=severity level+number of accesses; or risk score=severitylevel*number of accesses.In another example, if the access parameter was determined to be set atstep 430, the risk score calculation may be:risk score=severity level+permission ACL+number of accesses; orrisk score=severity level*permission ACL*number of accesses.

At step 450, a determination is made of whether the configurationparameters include a coefficient parameter for the risk scorecalculation. If a coefficient parameter is included, processing logicproceeds to step 460. If a coefficient parameter is not included,processing logic proceeds to step 470.

At step 460, one or more coefficients of values used for the data objectin calculating the risk score are adjusted. For example, if the riskscore calculation includes data object values for severity level,permission ACL, and access information, and the configuration parametersinclude a coefficient for severity level equal to 1.0 and a coefficientfor access equal to 0.5, the risk score may be calculated as:risk score=(1.0*severity level)+(0.5*number of accesses)+permission ACL.In some embodiments, if a coefficient parameter is set, but thecorresponding value is not set to be used in the calculation (e.g., acoefficient parameter of 1.0 is set for access, but the access value isnot set to be included in the risk score), the coefficient parameter maynot be used.

At step 470, a determination is made of whether there are any additionalconfiguration parameters set for the risk score calculation. Ifadditional configuration parameters are set for the risk scorecalculation, the method 400 proceeds to step 480. If there are noadditional configuration parameters set for the risk score calculation,the method 400 ends.

At step 480, the risk score calculation is adjusted based on theadditional parameter. In one embodiment, the additional parameter may bea type of operation to use in calculating the risk score. In someembodiments, the additional parameter may include more than one type ofoperation to use in calculating the risk score. In some embodiments, theoperation to be used in calculating the risk score may be a sum of datavalues associated with the data object. In some embodiments, theoperation to be used in calculating the risk score may be a product ofdata values associated with the data object. The risk score calculationcan be adjusted to use the type of operation specified by the additionalparameter to calculate the risk score. For example, if the type ofoperation is set to a summation, the risk score calculation may be:risk score=severity level+permission ACL.In another example, if a first type of operation is set to a summationand a second type of operation is set to a product, the risk scorecalculation may be:risk score=severity level+permission ACL*number of accesses.

FIG. 5 illustrates an exemplary GUI for presenting a risk report, inaccordance with one embodiment of the invention. In this example, GUI500 presents a risk score 510 for a folder 520 selected by a user. Insome embodiments, the risk report may also include additional data for afolder 520. One or more DLP policies 530 violated in the folder 520 maybe listed. A number of files 540 violating the DLP policies 530 withinthe folder 520 may also be included in the risk report. A number ofincidents 550 associated with a file in folder 520 may be included inthe risk report. Owners 560 owning a large number of confidential filesmay be included in the risk report. An access trend 570 may be includedin the risk report showing the number of confidential files 580 across atime period (e.g., every month for 12 months).

FIG. 6 illustrates a diagrammatic representation of a machine in theexemplary form of a computer system 600 within which a set ofinstructions, for causing the machine to perform any one or more of themethodologies discussed herein, may be executed. In alternativeembodiments, the machine may be connected (e.g., networked) to othermachines in a LAN, an intranet, an extranet, or the Internet. Themachine may operate in the capacity of a server or a client machine inclient-server network environment, or as a peer machine in apeer-to-peer (or distributed) network environment. The machine may be apersonal computer (PC), a tablet PC, a set-top box (STB), a PersonalDigital Assistant (PDA), a cellular telephone, a web appliance, aserver, a network router, switch or bridge, or any machine capable ofexecuting a set of instructions (sequential or otherwise) that specifyactions to be taken by that machine. Further, while only a singlemachine is illustrated, the term “machine” shall also be taken toinclude any collection of machines that individually or jointly executea set (or multiple sets) of instructions to perform any one or more ofthe methodologies discussed herein.

The exemplary computer system 600 includes a processing device(processor) 602, a main memory 604 (e.g., read-only memory (ROM), flashmemory, dynamic random access memory (DRAM) such as synchronous DRAM(SDRAM), etc.), a static memory 606 (e.g., flash memory, static randomaccess memory (SRAM), etc.), and a data storage device 618, whichcommunicate with each other via a bus 630.

Processor 602 represents one or more general-purpose processing devicessuch as a microprocessor, central processing unit, or the like. Moreparticularly, the processor 602 may be a complex instruction setcomputing (CISC) microprocessor, reduced instruction set computing(RISC) microprocessor, very long instruction word (VLIW) microprocessor,or a processor implementing other instruction sets or processorsimplementing a combination of instruction sets. The processor 602 mayalso be one or more special-purpose processing devices such as anapplication specific integrated circuit (ASIC), a field programmablegate array (FPGA), a digital signal processor (DSP), network processor,or the like. The processor 602 is configured to execute the processinglogic 626 for performing the operations and steps discussed herein.

The computer system 600 may further include a network interface device622. The computer system 600 also may include a video display unit 610(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), analphanumeric input device 612 (e.g., a keyboard), a cursor controldevice 614 (e.g., a mouse), and a signal generation device 620 (e.g., aspeaker).

The data storage device 618 may include a computer-readable medium 624on which is stored one or more sets of instructions (e.g., software 626)embodying any one or more of the methodologies or functions describedherein. The software 626 may also reside, completely or at leastpartially, within the main memory 604 and/or within the processor 602during execution thereof by the computer system 600, the main memory 604and the processor 602 also constituting computer-readable media. Thesoftware 626 may further be transmitted or received over a network 616via the network interface device 622.

While the computer-readable medium 624 is shown in an exemplaryembodiment to be a single medium, the term “computer-readable medium”should be taken to include a single medium or multiple media (e.g., acentralized or distributed database, and/or associated caches andservers) that store the one or more sets of instructions. The term“computer-readable medium” shall also be taken to include any mediumthat is capable of storing, encoding or carrying a set of instructionsfor execution by the machine and that cause the machine to perform anyone or more of the methodologies of the present invention. The term“computer-readable medium” shall accordingly be taken to include, butnot be limited to, solid-state memories, optical media, and magneticmedia.

In the above description, well-known structures and devices are shown inblock diagram form, rather than in detail, in order to avoid obscuringthe present invention. Some portions of the description are presented interms of algorithms and symbolic representations of operations on databits within a computer memory. These algorithmic descriptions andrepresentations are the means used by those skilled in the dataprocessing arts to most effectively convey the substance of their workto others skilled in the art. An algorithm is here, and generally,conceived to be a self-consistent sequence of steps leading to a desiredresult. The steps are those requiring physical manipulations of physicalquantities. Usually, though not necessarily, these quantities take theform of electrical or magnetic signals capable of being stored,transferred, combined, compared, and otherwise manipulated. It hasproven convenient at times, principally for reasons of common usage, torefer to these signals as bits, values, elements, symbols, characters,terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the above discussion, itis appreciated that throughout the description, discussions utilizingterms such as “identifying”, “applying”, “refraining”, “scanning”,“updating” or the like, refer to the actions and processes of a computersystem, or similar electronic computing device, that manipulates andtransforms data represented as physical (e.g., electronic) quantitieswithin the computer system's registers and memories into other datasimilarly represented as physical quantities within the computer systemmemories or registers or other such information storage, transmission ordisplay devices.

Embodiments of the present invention also relate to an apparatus forperforming the operations herein. This apparatus may be speciallyconstructed for the required purposes, or it may comprise a generalpurpose computer selectively activated or reconfigured by a computerprogram stored in the computer. As discussed above, such a computerprogram may be stored in a computer readable medium.

The algorithms and displays presented herein are not inherently relatedto any particular computer or other apparatus. Various general purposesystems may be used with programs in accordance with the teachingsherein, or it may prove convenient to construct a more specializedapparatus to perform the required method steps. The required structurefor a variety of these systems will appear from the description below.In addition, the present invention is not described with reference toany particular programming language. It will be appreciated that avariety of programming languages may be used to implement the teachingsof the invention as described herein.

It is to be understood that the above description is intended to beillustrative, and not restrictive. Many other embodiments will beapparent to those of skill in the art upon reading and understanding theabove description. The scope of the invention should, therefore, bedetermined with reference to the appended claims, along with the fullscope of equivalents to which such claims are entitled.

We claim:
 1. A method comprising: obtaining, by a computer system, aseverity level associated with a data object, wherein the severity levelis calculated based on presence of confidential information in the dataobject, the data object being a file or a folder, the severity levelbeing calculated using a data loss prevention policy in response to aviolation of the data loss prevention policy; obtaining, by the computersystem, metadata associated with the data object based on aconfiguration parameter, the metadata comprising at least one of accesspermission data for the data object and access usage data for the dataobject, wherein the configuration parameter defines the metadata toobtain to calculate a risk score; and calculating, by the computersystem, the risk score for the data object based on the severity leveland the metadata associated with the data object.
 2. The method of claim1, wherein if the data object is a folder comprising one or more files,the risk score for the folder comprises a risk score for each of the oneor more files.
 3. The method of claim 1, wherein the access permissiondata is a permission access control list associated with a number ofusers permitted to access the data object.
 4. The method of claim 1,wherein the access usage data for the data object defines historicaldata for the data object, the historical data comprising a number ofusers that have accessed the data object during a predetermined amountof time.
 5. The method of claim 1, further comprising: assigning aweight to the risk score for the data object, wherein the weight isassigned based on a risk score of one or more other data objects to beincluded in a risk report; creating the risk report including theweighted risk score for the data object; and displaying the risk reportin a user interface.
 6. A non-transitory computer readable storagemedium that provides instructions, which when executed on a computersystem cause the computer system to perform operations comprising:obtaining a severity level associated with a data object, wherein theseverity level is calculated based on presence of confidentialinformation in the data object, the data object being a file or afolder, the severity level being calculated using a data loss preventionpolicy in response to a violation of the data loss prevention policy;obtaining metadata associated with the data object based on aconfiguration parameter, the metadata comprising at least one of accesspermission data for the data object and access usage data for the dataobject, wherein the configuration parameter defines the metadata toobtain to calculate a risk score; and calculating the risk score for thedata object based on the severity level and the metadata associated withthe data object.
 7. The non-transitory computer readable storage mediumof claim 6, wherein if the data object is a folder comprising one ormore files the risk score for the folder comprises a risk score for eachof the one or more files.
 8. The non-transitory computer readablestorage medium of claim 6, wherein the access permission data is apermission access control list is associated with a number of userspermitted to access the data object.
 9. The non-transitory computerreadable storage medium of claim 6, wherein the access usage data forthe data object defines historical data for the data object, thehistorical data comprising a number of users that have accessed the dataobject during a predetermined amount of time.
 10. The non-transitorycomputer readable storage medium of claim 6, the operations furthercomprising: assigning a weight to the risk score for the data object,wherein the weight is assigned based on a risk score of one or moreother data objects to be included in a risk report; creating the riskreport including the weighted risk score for the data object; anddisplaying the risk report in a user interface.
 11. A system,comprising: a memory; and a processor coupled with the memory to obtaina severity level associated with a data object, wherein the severitylevel is calculated based on presence of confidential information in thedata object, the data object being a file or a folder, the severitylevel being calculated using a data loss prevention policy in responseto a violation of the data loss prevention policy; obtain metadataassociated with the data object based on a configuration parameter, themetadata comprising at least one of access permission data for the dataobject and access usage data for the data object, wherein theconfiguration parameter defines the metadata to obtain to calculate arisk score; and calculate the risk score for the data object based onthe severity level and the metadata associated with the data object. 12.The system of claim 11, wherein the processor is further to: assign aweight to the risk score for the data object, wherein the weight isassigned based on a risk score of one or more other data objects to beincluded in a risk report; create the risk report including the weightedrisk score for the data object; and display the risk report in a userinterface.